metasploit | e479cff41e57e42b07c8322340a41f3810334e5e18b884786c085f7616ba7af3 | Triage

Sharing

General

Target

e479cff41e57e42b07c8322340a41f3810334e5e18b884786c085f7616ba7af3
Size

1.8MB
Sample

240418-mt58aaca9z
MD5

fb06326f3de40596615223a2802a212d
SHA1

8632d1f4370572eba8acad40fb1ecc30124a3c80
SHA256

e479cff41e57e42b07c8322340a41f3810334e5e18b884786c085f7616ba7af3
SHA512

9828b9a2af4786bbb0a954bbda5a938a49495fc8ab93d18c072752c83292a035d187cac84f5abe70467f4bad06b726abecea5304435ae9eedc5e339abfabb230
SSDEEP

24576:/3vLRdVhZBK8NogWYO09tOGi9J3YiWdCMJ5QxmjwC/hR:/3d5ZQ1bxJIiW0MbQxA

Score

10^/10

metasploit backdoor discovery spyware stealer trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

1.15.12.73:4567

Targets

- Target
  
  e479cff41e57e42b07c8322340a41f3810334e5e18b884786c085f7616ba7af3
- Size
  
  1.8MB
- MD5
  
  fb06326f3de40596615223a2802a212d
- SHA1
  
  8632d1f4370572eba8acad40fb1ecc30124a3c80
- SHA256
  
  e479cff41e57e42b07c8322340a41f3810334e5e18b884786c085f7616ba7af3
- SHA512
  
  9828b9a2af4786bbb0a954bbda5a938a49495fc8ab93d18c072752c83292a035d187cac84f5abe70467f4bad06b726abecea5304435ae9eedc5e339abfabb230
- SSDEEP
  
  24576:/3vLRdVhZBK8NogWYO09tOGi9J3YiWdCMJ5QxmjwC/hR:/3d5ZQ1bxJIiW0MbQxA
Score

10^/10

metasploit backdoor discovery spyware stealer trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Peripheral Device Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

metasploitbackdoordiscoveryspywarestealertrojan

behavioral2

metasploitbackdoordiscoveryspywarestealertrojan